Export limit exceeded: 372813 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372813 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-44607 | 1 Thedaylightstudio | 1 Fuel Cms | 2024-11-21 | 5.4 Medium |
| A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file. | ||||
| CVE-2021-44599 | 1 Online Enrollment Management System Project | 1 Online Enrollment Management System | 2024-11-21 | 7.5 High |
| The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve sensitive information for all users of this system. | ||||
| CVE-2021-44598 | 1 Attendance Management System Project | 1 Attendance Management System | 2024-11-21 | 6.1 Medium |
| Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The attacker can access the system, by using the XSS-reflected method, and then can store information by injecting the admin account on this system. | ||||
| CVE-2021-44593 | 1 Simple College Website Project | 1 Simple College Website | 2024-11-21 | 8.1 High |
| Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL injection in the username parameter on /admin/login.php. | ||||
| CVE-2021-44591 | 1 Libming | 1 Libming | 2024-11-21 | 6.5 Medium |
| In libming 0.4.8, the parseSWF_DEFINELOSSLESS2 function in util/parser.c lacks a boundary check that would lead to denial-of-service attacks via a crafted SWF file. | ||||
| CVE-2021-44590 | 1 Libming | 1 Libming | 2024-11-21 | 6.5 Medium |
| In libming 0.4.8, a memory exhaustion vulnerability exist in the function cws2fws in util/main.c. Remote attackers could launch denial of service attacks by submitting a crafted SWF file that exploits this vulnerability. | ||||
| CVE-2021-44586 | 1 Dst-admin Project | 1 Dst-admin | 2024-11-21 | 7.5 High |
| An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information. | ||||
| CVE-2021-44585 | 1 Jeecg | 1 Jeecg Boot | 2024-11-21 | 6.1 Medium |
| A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event. | ||||
| CVE-2021-44584 | 1 Emlog | 1 Emlog | 2024-11-21 | 6.1 Medium |
| Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parameter. | ||||
| CVE-2021-44582 | 1 Money Transfer Management System Project | 1 Money Transfer Management System | 2024-11-21 | 8.8 High |
| A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL. | ||||
| CVE-2021-44581 | 1 Kreado | 1 Kreasfero | 2024-11-21 | 7.5 High |
| An SQL Injection vulnerabilty exists in Kreado Kreasfero 1.5 via the id parameter. | ||||
| CVE-2021-44568 | 2 Opensuse, Redhat | 3 Libsolv, Satellite, Satellite Capsule | 2024-11-21 | 6.5 Medium |
| Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at src/solver.c (line 1940 & line 1995), which could cause a remote Denial of Service. | ||||
| CVE-2021-44567 | 1 Rosariosis | 1 Rosariosis | 2024-11-21 | 9.8 Critical |
| An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php. | ||||
| CVE-2021-44566 | 1 Rosariosis | 1 Rosariosis | 2024-11-21 | 5.4 Medium |
| A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php. | ||||
| CVE-2021-44565 | 1 Rosariosis | 1 Rosariosis | 2024-11-21 | 5.4 Medium |
| A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields. | ||||
| CVE-2021-44564 | 1 Kalkitech | 40 Sync2000-m1, Sync2000-m1 Firmware, Sync2000-m2 and 37 more | 2024-11-21 | 8.1 High |
| A security vulnerability originally reported in the SYNC2101 product, and applicable to specific sub-families of SYNC devices, allows an attacker to download the configuration file used in the device and apply a modified configuration file back to the device. The attack requires network access to the SYNC device and knowledge of its IP address. The attack exploits the unsecured communication channel used between the administration tool Easyconnect and the SYNC device (in the affected family of SYNC products). | ||||
| CVE-2021-44557 | 1 Kb | 1 Multiner | 2024-11-21 | 9.1 Critical |
| National Library of the Netherlands multiNER <= c0440948057afc6e3d6b4903a7c05e666b94a3bc is affected by an XML External Entity (XXE) vulnerability in multiNER/ner.py. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS. | ||||
| CVE-2021-44556 | 1 Kb | 1 Digger | 2024-11-21 | 9.1 Critical |
| National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS. | ||||
| CVE-2021-44554 | 1 Cybelesoft | 1 Thinfinity Virtualui | 2024-11-21 | 5.3 Medium |
| Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest and krgtbt. | ||||
| CVE-2021-44550 | 1 Stanford | 1 Corenlp | 2024-11-21 | 9.8 Critical |
| An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159). | ||||